CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Authenticated builders can read arbitrary server files via path traversal in ZIP processing, exposing secrets and enabling full platform compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30240?
CVE-2026-30240 is a critical path traversal vulnerability in budibase, published on 9 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Progressive Web App) ZIP processing endpoint (POST /api/pwa/process-zip) allows an authenticated user with builder privileges to read arbitrary files from the server filesystem, including /proc/1/environ which contains all environment variables — JWT secrets, database credentials, encryption keys, and API tokens. The server reads attacker-specified files via unsanitized path.join() with user-controlled input from icons.json inside the uploaded ZIP, then uploads the file contents to the object store (MinIO/S3) where they can be retrieved through signed URLs. This results in complete platform compromise as all cryptographic secrets and service credentials are exfiltrated in a single request.
Which versions are affected by CVE-2026-30240?
It affects 1 product.
Products include Budibase Budibase.
How do I fix CVE-2026-30240?
No fix has been published for CVE-2026-30240 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-30240 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30240 exists.
Other vulnerabilities in budibase
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-41428 Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
Sources
Also known as GHSA-pqcr-jmfv-c9cp.